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We investigate a fundamental property of device independent security in quantum cryptography 
by characterizing probability distributions which are necessarily independent of the measurement 
results of any eavesdropper. We show that probability distributions that are secure in this sense are 
exactly the extremal quantum probability distributions. This allows us to give a characterization 
of security in algebraic terms. We apply the method to common examples for two-party as well as 
multi-party setups and present a scheme for verifying security of probability distributions with two 
parties, two measurement settings, and two outcomes. 



The idea of using quantum systems for secure commu- 
nication has been around for more than 25 years now. 
But still the boundaries of quantum cryptography have 
not been fully understood. Only recently a remarkable 
feature of quantum systems has been realized, namely 
that observed violations of a Bell inequality may imply 
cryptographic security, even if the measurements that 
lead to the violation are unknown to legitimate parties. 
This principle goes under the name "device independent 
security" and has been proven against collective attacks 
[Tj. and recently against arbitrary attacks for memory- 
less measurement devices [2J [3J. But still no proof for 
the most general situation is known. In this paper we 
focus on the question, when measurement outcomes ob- 
tained by the legitimate parties are independent of mea- 
surements performed by an eavesdropper. We give a nec- 
essary and sufficient condition for this under the assump- 
tion that the probability distributions are known without 
error. 

We consider a quantum correlation experiment with 
N separated parties, each performing one of M differ- 
ent local measurements with K outcomes. We denote 
this situation by the triple (N,M,K). In a device in- 
dependent scenario the parties (usually N=2) want to 
extract a secret key from the observed correlations in 
which the security estimation is solely based on the mea- 
sured probability distributions. There are no assumption 
on the proper functioning of the measurement devices or 
the measured system, e.g., on their dimension. Proba- 
bility distributions that are useful for cryptography have 
to feature certain properties. First, the obtained corre- 
lations should not permit a local hidden variable (LHV) 
model as in this potential adversary can have full 

knowledge about the correlations. Second, the correla- 
tions should only be weakly correlated to any possible 
measurement of an adversary. The first property is well 
known to be equivalent to violate a Bell inequality (see 
below), but the latter still lacks a concrete characteriza- 
tion. 

In this paper we address this problem by specifying 
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all probability distributions which do not allow a LHV 
model and are provably statistically independent of the 
knowledge of any eavesdropper. We show that these 
probability distributions, which we call secure, can com- 
pletely be characterized in geometric terms. Indeed in the 
convex body Q of all quantum probability distributions 
the secure points are precisely the non-classical extremal 
points, i.e., those which are not deterministic and can- 
not be obtained as proper convex combination of other 
points in Q. 

The characterization of extremal points in Q is of gen- 
eral interest and numerical approaches to determine them 
are known (4j |5] . In our examples, we provide and dis- 
cuss different tools to certify, respectively, find extremal 
probability distributions for particular (N, M, if)-cases. 
In many situations it turns out to be easier to establish a 
stronger property, i.e., that the algebraic structure of the 
measurement operators is completely determined by the 
probability distributions. This also leads to a stronger 
notion of security. The most prominent example (see ex- 
ample 3) are correlations which maximally violate the 
Clauser-Horne-Shimony-Holt (CHSH)-inequality [6 . 

Our results have links to previous results obtained in 
the framework of non-signaling correlations, i.e., theories 
that are more general than quantum theory. One direc- 
tion of our result, namely that extremality implies secu- 
rity was proven in [7] for non-signalling theories in the 
bipartite case. In this paper, we only discuss the quan- 
tum framework, although our proofs can in principle be 
adapted to any non-signaling theory. 

Definitions. For simplicity, we consider the general 
(N, M, K) case, even though the results are also valid for 
different numbers of measurement settings and outcomes 
for each party. We denote the probability for obtaining 
a string of outcomes x = (x\, xjv) given a string of 
measurement settings s — (si, spf) by P(x|s). These 
numbers are assumed to be known exactly, i.e., we do 
not consider the uncertainties involved in estimating such 
probabilities from a finite sample. 

The set of probability distributions P conform to a 
LHV model, i.e., which can be realized by assuming the 
measurements reveal outcomes whose probabilities are 
predetermined, is called the set C of classical correla- 
tions. It is a polytope, i.e. generated by a finite number 
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of extremal points, which are given by the assignment 
of definite outcomes to each measurement. The faces (of 
maximal dimension) correspond to inequalities, which are 
linear in P, and are called (tight) Bell inequalities. In the 
(2, 2, 2) case all tight Bell inequalities are equivalent to 
the CHSH inequality [8j . A survey about Bell inequalities 
and further references can be found in [5] 

We are interested in the set Q of quantum correlations, 
which is defined as the set of all probability distributions 
P that can be realized by a quantum representation 



(x\s) = tv(pF(x\s)), 



(1) 



where p is a density operator on a Hilbert space , 
whose dimension is not constrained and can be infinite, 
and F(x\s) = Fi(xi\si) ■ ■ ■ Fn(xn\sn) is a product of 
commuting operators on Jif. {Fi(x\s)} x are the mea- 
surement operators of the observable chosen by the i th 
party according to the measurement setting s. Thus the 
Fi(x\s) are positive operators satisfying ^2% =1 Fi(x\s) — 
1, and have to commute for different sites, since the par- 
ties are independent. As shown in Appendix [A] every P 
which can be realized in this way can also be realized in a 
simplified "standard" form, in which p = | O) (0| is a pure 
state and the operators Fi(x\s) are projections. More- 
over, in the standard form is cyclic for the algebra 
A(F), which is obtained from the Fi(x\s) by taking prod- 
ucts, linear combinations and limits of expectation val- 
ues. Cyclic means that the vectors A\£l) with A 6 A(F) 
span a dense subspace in Jif. 

The set Q is a closed convex set which has in contrast 
to C a continuum of extremal points (see for instance 
|10j). Bell inequalities define the boundary between C 
and Q. The set Q can be characterized similarly by in- 
equalities that are linear in P, satisfied by all P E Q and 
tight for at least one P € Q. We call them Tsirelson in- 
equalities. For every linear expression in P there is a max- 
imum on C, and another, usually larger one on Q which 
leads to a Tsirelson inequality. Computational methods 
to derive such maximal violations in Q are derived in 
|H [5]. For the CHSH expression in the (2, 2, 2)-case these 
maxima are 2 [5] and 2y/2 [11], respectively. The value 4 
is achieved on the set of "no-signalling correlations" V , de- 
fined by the property that the measurement of one party 
does not change the probabilities observed by another. 
Similar to C, V is generated by finitely many extremal 
points |7_. It holds with proper inclusion Cc Q C V . 

Secure ■probability distributions. We model the eaves- 
dropper by another quantum party, whose measurements 
must commute with all F(x\s). Accordingly, we call a 
probability distribution P secure, if P does not factor- 

ize, i.e., P(x|s) 7^ ITjLi ^j( x j\ s j)j an d f° r an y quantum 
representation and any operator E commuting with all 

Fi(xi\si) 



tr 



(pEF(x\sf) = tr(pE) P(x\s) 



(2) 



not a product is necessary to exclude classical determin- 
istic points, i.e. the extremal points of C, for which ([2 1 is 
satisfied trivially. As we will see, this excludes all proba- 
bility distributions which can be realized in LHV models. 

In device independent cryptography, our definition en- 
sures that an attack of an eavesdropper can never be 
better than a classical guess. The number of extractable 
secure bits by classical postprocessing can then be char- 
acterized by the classical smooth min-entropy |12| . 

Our first main result gives a geometric interpretation 
of secure probability distributions: A probability distri- 
bution P is secure, if and only if it is extremal in Q\C. 

The argument is straightforward. Suppose, P is se- 
cure, but not extremal. Then there exists a direct 
sum representation and a convex decomposition with 
P = APi + (1 - A)P 2 , < A < 1. Now use the defini- 
tion Q with E being the projector onto the first/second 
summand to get P = Pi and P = P 2 . This shows that the 
convex combination is indeed trivial and P is extremal. 
As all extremal correlations in C are of product form, it 
follows that P ^ C. Conversely, suppose P is extremal 
and P ^ C. As before, we can conclude that P cannot 
be of product form. Take any commuting < E < 1 
and set A = tv{pE). Define P : = (1/ \)tr (pEF(x\s)) 
and P 2 = (1/(1 - A))tr(p(l - E)F(x\s)) such that P = 
APi + (1 - A)P 2 . As P is extremal, it holds that P = Pj, 
which is just equation so P is secure. 

To decide whether a given probability distribution is 
secure has now been reduced to certifying extremality 
in Q. This is in general a hard problem. Even in the 
(2, 2, 2)-case no simple algebraic constraints are known 
to verify extremality of a given P. In this paper, we will 
provide an explicit, yet limited certification scheme in 
example 3. 

Algebraically secure probability distributions. There is 
a straightforward way to strengthen the definition of se- 
cure probability distributions by extending the factoriza- 
tion property to a larger set of observables. The reason 
is that the stronger notion of security is often easier to 
verify. 

A probability distribution P is called algebraically se- 
cure, if it is secure and for any quantum representation 
and any operator E commuting with all Fi(xi\si) 



(3) 



trlpEF) = tr(pE)tr(pF), 



The operator E represents all possible measurements an 
eavesdropper could perform. The requirement that P is 



for all F e A(F). 

They are characterized as follows: A probability distri- 
bution P is algebraically secure, if and only if it is ex- 
tremal in Q\C and has a unique quantum representation, 
up to unitary equivalence. 

A sketch of the proof goes as follows. Assume first 
that P is algebraically secure, and therefore extremal. 
Let p = \VL){Vt\ together with F^x^si), and p' = \fl'){fl'\ 
with F[{xi\si) be two representations of P on suitable 
Hilbert spaces ffl , M" . Condition (J3J) implies that for 
all corresponding operators F £ A(F) and F' g A(F'), 
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tr(pF) = tr(p'F'). Otherwise, the direct sum represen- 
tation with E chosen as the projector on the first or sec- 
ond summand contradicts (|3]). Define then the unitary 
operator U via J7F|f2) = F'\il') which transforms one 
representation into the other. Because |f2) and are 
cyclic U can be extended to a unitary from J$? to M" . 
Conversely, assume that P is extremal and all represen- 
tations are unitarily equivalent. Let < E < 1 be an op- 
erator commuting with all Fi(xi\si). Since P is extremal, 
tr(p.E) V^pv^ together with the operators Fi(xi\si) is a 
valid quantum representation of P. Hence, E = 1, which 
implies (|3|. 




FIG. 1: Sketch of the set of quantum representations S 
(above) and the set of probability distributions Q (below). 
An extremal probability distribution can either correspond 
to a unique point (a) or to a face of S (b). Other faces of 5 
can be mapped to faces of Q (c). Not all extremal points of 
<S are also extremal for Q (d). 

Secure vs. algebraically secure. It is now interesting 
to identify cases for which the notions of secure and al- 
gebraically secure coincide. To formalize the question, 
we can introduce a map T from all possible (unitary in- 
equivalent) quantum representations S (= S(N, M, K)) 
to the set of probability distributions Q. The set S can 
be considered as a convex set and the map T is linear 
and surjective, but not injective. The extremal points of 
S are exactly the irreducible quantum representations, 
which are defined by the property that the only invari- 
ant subspaces of A(F) are {0} and Jtf?. As shown in 
|13| . each extremal probability distribution P g Q ad- 
mits an irreducible quantum representation. Hence, a 
secure probability distribution P is algebraically secure if 
and only if r _1 (P) is exactly one extremal point in S. In 
FIG. [I] the point (a) corresponds to an algebraically se- 
cure probability distribution, while the point (b) and the 
endpoints of the line (c) are secure, but not algebraically 
secure. 

In the following we discuss examples, for which we pro- 
vide methods to find extremal points and criterions to 
decide when they are also algebraically secure. 

Example 1: The (N,2,2)-case. The algebraic struc- 
ture of the (N, 2, 2)-case is quite well understood (see 
e.g. |14| and references therein). All irreducible quan- 



tum representations are in this case given on an N- 
qubit subspace Jtf? = ^f^C 2 with an arbitrary pure 
state ip g Jff and measurements, which are parameter- 
ized by N angles 9i,...,9^ (9i £ [0,7r]). The measure- 
ments are given at site i as ^(1,1) = |(1 + 03) and 
F,(l,2) = |(1 + sin(6>i)eri + cos(9i)a 3 ), together with 
their complements Fi(2, s) = 1 — Fi(l, s). The er^ denote 
the Pauli matrices and we omitted the identities on the 
tensor factors for the other parties. This parametriza- 
tion in {9{\ and ip is sufficient to determine the whole 
convex body Q. An arbitrary P is a direct sum of at 
most A N + 1 irreducible representations. Compare [TS] 
for an alternative deviation of these results. 

In order to find extremal points and test algebraic 
uniqueness we combine the above parametrization with 
a maximization of a Tsirelson inequality. More explic- 
itly, for each functional given by coefficients {c(x|s)}, 
we can ask for the maximal quantum violation, i.e., 
Q c := sup PeQ J2 x ,s c fel*)P(^|s)- In general, Q c can 
be computed by a hierarchy of semi-definite programs 
[H|S]. Here, we follow another strategy by parameter- 
izing the corresponding operator C = ^ c(x\s)F(x\s) = 
C(9i, 9n) by means of the irreducible representations. 
The maximization of (ip\C(9i, ...,9;y)\ip) over all 9i £ 
[0, 7r) and ip G C 2 ™ yields Q c . Moreover, if there is ex- 
actly one set of parameters 9\ 1 ...,9n and a unique state 
tp for which the maximum is attained, the corresponding 
probability distribution P is algebraically secure. In the 
case where more than one possible choice of 9i, 9jy, tp 
leads to a maximal violation, we can determine the con- 
vex span of the corresponding probability distributions. 
This corresponds to the face given by the intersection of 
Q and the hyperplane {P | Y, x , s c(x\s)F(x\s) = Q c }. Ex- 
tremal points of that face are extremal points of Q, and 
thus, secure probability distributions. 

As a straightforward application, one can deduce that 
the probability distributions leading to maximal violation 
of Mermin's inequalities |16_ are algebraically secure. 

Example 2: Certificate of extremality in the (2,2,2)- 
case. The idea of the foregoing example was to find ex- 
tremal P's by maximizing a given Tsirelson expression. 
Here, we start with a particular P and want to construct 
a Tsirelson inequality saturated by P. If there exists such 
an inequality which is not trivial, i.e. cannot be saturated 
by any LHV model, and no other probability distribution 
in Q saturates it (or alternatively that just one quantum 
representation of P exists), extremality of P is certified. 

We focus on the (2,2,2)-case and discuss a method how 
to construct a maximally violated Tsirelson expressions 
for a given P. It comes along with a natural order of com- 
plexity for which we solve the lowest order explicitly. The 
main ingredient is again the parametrization of the irre- 
ducible quantum representations by a state i/i G C 2 ® C 2 
and two angles 9 = (9 a, 9b) (see previous example) for 
which we denote the obtained probability distribution 
by P(e j ^ ) ). Because we are only interested in extremal 
Ps, it is sufficient to consider V(e^) with a real ip (see 
Appendix \Bn . Since we have dichotomic measurements 
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we can equivalently work with ±1 valued observables in- 
stead of measurement operators. We denote the observ- 
ables on Alice's (Bob's) side by Ai,A 2 (B 1 ,B 2 ) and set 
A a = B = 1. 

Finding a Tsirelson inequality for P(e.jf,) is equiva- 
lent to the following task: Construct a positive oper- 
ator T = J^kPki^B^PkiA^B,), with PkiA^Bj) 
polynomials in Ai <E) Bj, i,j — 0,1,2. such that (i) 
P k {A l {8 A ),B J {8 B ))^ = for all k and (ii) T = 
Yli j=o UjAi^Bj for all possible observables in Jtf. Here, 
Ai(6ji), Bj(6b) denote the observables of the represen- 
tation (8,ip). Condition (ii) implies that T can be in- 
terpreted as a linear functional of P, (i) that it is for 
P(g ) ^ I ), and the ansatz for T that T is a positive opera- 
tor and thus its associated functional on P is positive for 
each Peg. 

In order to solve the problem a constraint on the 
degree of the polynomials P k in the ansatz for T has 
to be imposed. This introduces a natural hierarchy, 
where the order limits the possible P (#,,/,) f° r which 
the method succeeds. For the simplest ansatz, P k = 
Ei=i(afcj^j ® 1 ~ Pkjl ® Bj) (a kj ,/3 kj £ K), the 
P for which a Tsirelson inequality can be constructed 
are exactly the ones which correspond to a representa- 
tion (4>x ,8a, 9b) with maximally entangled state <fi~ = 
^(cosx, =F smx, smx, ± cos x) (x G [0, tt)) for which 

sin(2x) sin(2a; ± 8b) ^ „ 

sin(2a; - 8 A ) sin(2x -8 A ± 9~b) 

holds. The corresponding Tsirelson inequality and the 
derivation can be found in Appendix [B] 

Example 3: The (2,M,2)-case for full correlations. 
The difficulty of finding extremal points in the (2, M, 2) 
scenario can be considerably reduced, as it is sufficient 
to consider only full correlations. This was shown by 
Tsirelson in [TT] where he characterized all extremal 
points. In the following let At, Bj, i,j £ {1, . . . ,M}, de- 
note ±1 valued observables located by Alice and Bob, and 
p a density operator. The set of quantum correlations 
Qcor is given by all correlation tables = tr(AiBjp) 
which can be obtained by means of a quantum repre- 
sentation. In |11| it was proven that all quantum rep- 
resentations of an extremal correlation table which is 
not deterministic have uniform marginal distributions 
tr(Aip) = tr(Bjp) = 0. Thus, non-deterministic ex- 
tremal correlations in Q cor correspond to secure probabil- 
ity distributions in Q. Furthermore, an extremal correla- 
tion table which allows just one quantum representation 
gives rise to an algebraically secure point. 

For every correlation table exists a so-called c- 
system, that is, a collection of vectors xi, yj (i,j £ 
{1, . . . , M}) with ||xj|| < 1, \\yj\\ < 1 in an Euclidian 
space with dimension M, such that Cij — (xi,yj ). If 
P is extremal, the corresponding c-systems are isomet- 
ric to each other, = \\yj\\ = 1 and the linear hull 
of the {xi} and {yj} coincide. Calling the dimension 
of the linear hull the rank r of the c-system, it further 



follows that {xi ® Xi,yj ® yj} span the symmetric sub- 
space ofR 1 ~® R r . The foll owing inequalities hold: r < M, 
r < -1/2 + ^/1/4 + 4M) andr(r + l)/2 < 2M-1. There 
are two cases to be distinguished. For c-systems with 
even rank, the representation is unique (up to unitary 
equivalence), while for c-systems with odd rank, there 
are exactly two non-equivalent representations. 

With this, the question of secure versus algebraically 
secure is equivalent to determining the rank of the c- 
system which corresponds to the given correlation ta- 
ble. According to the inequalities above, it follows di- 
rectly that all probability distributions in the (2, 2, 2) and 
(2, 3, 2)-case which correspond to non-classical extremal 
correlations in Q cor are algebraically secure. 
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Appendix A: Standard Form of a Quantum 
Representation 

As described in the paper, we consider a general proba- 
bility distribution obtained by N parties, having M mea- 
surements with K outcomes each. Let x € {1,..,K} 
denote one local measurement outcome, s € {1,...,M} 
one setting and x (s) denote the TV-element strings of 
outcomes (measurements) for all parties. We define a 
probability distribution P to be quantum and thus ly- 
ing in Q, if there exists a Hilbert space together 
with a state p and positive operator valued measures 
{Fi(x, s)}x = i, i = lj ...,N and s = 1,...,M, such that 
[Fj(x, s), Fj(x' , s')] — for every i ^ j, and it holds that 

P(x|s) =ti(pF(x\s)), (Al) 

where F(x,s) = Yli=i Fi(xi\si). 

The goal is to show that for any such P one can find 
a quantum representation in standard form, that is, a 
representation which consists of projective measurements 
and a pure cyclic state for A(F). The proof is given by 
an explicit construction. 

First, we recapitulate the definition of A{F) and what 
it means that a vector is cyclic for A(F). The alge- 
bra generated by the operators Fi(x,s), A(F), is de- 
fined as the closure of the set of all linear combinations 
of products of Fi{x,s), i.e. span c {^Qr =1 F^ (x^ |sj,)|m € 
N} C B(Jf?) with respect to taking expectation val- 
ues (i.e., the weak* closure). This means that we 
add every G £ B(Jff) for which a sequence {Gj} 
in span.c{nZLi ■^ii( a; iil s ti)l m ^ ^} exists, such that 
lhxtfc-^oo tx(pGj) — tr(/?G) for every state p in J$f. In 
mathematical terminology this is called a von Neumann 
algebra [17]. We call now a pure state |f2) cyclic for A(F), 
if the closure of {G\9)\G £ A{F)} is the entire Hilbert 
space J4f. 
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We begin by turning the measurement operators 
Fi(x\s) into projective ones, by applying a version of the 
Naimark dilation successively to each observable Fj(-,s). 
It suffices to do this for one of the observables, pro- 
vided we verify that in this construction not only the re- 
quired commutativity conditions are preserved, but also 
the projection valuedness of any of the other measure- 
ments. So in order to turn the observable Fj(-,s) in to 
a projective measurement, we define the Hilbert space 
Jt? — ©J—J J^ci where each of the Jff x is a copy of the 
given Hilbert space J$?. We denote by P x the projec- 
tion onto the summand with label x, and introduce the 
isometry 

V : -> JT V<f> = y/Fi(x,s)<f). 

x 

Then we will set Fi(x,s) = P x , so that V* Fi(x, s)V — 
Fi(x,s). For other observables at the same site, e.g., 
Fi(-, r) with r =/= s, we set 



Fi(x,r) 



VFi(l,r)V* + (1 - VV*) forx = l 
VFi(x,r)V* forx>l 



Because V is an isometry, we again have V*F i (x 1 r)V = 
Fi(x, r) for all x. With V* we denote the adjoint operator 
of V. Moreover, Fi(x,r) 2 = VFi(x,r) 2 V* for x > 1 and 
Fi(l,r) 2 = VFi(l,r) 2 V* + (1 - W), so that a projec- 
tive measurement remains projective. For observables at 
all other sites j ^ i we take Fj(x,r) — ® , Fj(x,r), i.e., 
as the original observable acting the same on each of the 
summands. Once again, this preserves projective valued- 
ness, and not only satisfies V*Fj(x,r)V — Fj(x,r), but 
even the stronger relation Fj(x,r)V — VFj(x,r). With 
this relation it is easy to see that the Fj(x, r) for different 
j (possibly = i) commute, so we can form the product 
F(x\s) unambiguously, and that V* F(x\s)V = F(x\s). 
Hence if we define the state p — V pV* , we obtain a 
quantum representation of the same point P G Q, with 
Fi(-,s) projective measurements. 

In order to turn p into a pure and cyclic state we 
can do the Gelfand-Naimark-Segal (GNS) construction 
(Theorem 2.3.16 in [T7]) of the algbra A(F) with re- 
spect to the state p. We consider A(F) together with 
the positive semidefinite sesquilinear form defined by 
(A\B) = tr(pA*B) as a pre-Hilbert space. To get a 
Hilbert space we first take the quotient with respect to 
the left ideal I = {A G A(F)\tr(pA* A) = 0} and then 
the completion with respect to the scalar product (-|-). 
We denote the obtained Hilbert space by jf? and its el- 
ements (in the densely defined subspace) are given by 
the equivalence classes if a — {A\A = A + J, J G 1} for 
A G A(F). We define the representation tt of A(F) on 

by the equation n(A)ip B = %p A B for A, B e A{F). 
This representation is a *-homomorphism, that is, it re- 
spects products and the adjoint operation. Hence, the 
operators Fi(x\s) = 7r(-Fj(a;|s)J satisfy the same commu- 
tation relation as Fi(x\s) and furthermore, projections 



are mapped onto projections. If we set Q = tpi, we have 
that (n\F(x\s)n) = tr(pF(x\s)) = P(x\s). We therefore 
found a quantum representation of P given by Fi(x\s) 
and a pure state |fi) which is by definition cyclic. 



Appendix B: Lowest Order of the (2,2,2)-Certificate 

The goal is to check extremality for a given P in the 
(2,2,2)-case. We use the same notation as introduced in 
the example 2 in the paper. Since we are only inter- 
ested in extremal P in Q, we can restrict to the ones 
which belong to an irreducible quantum representation 
(see example 1 in the paper). They are described in a 
Hilbert space Jff = C 2 ® C 2 and parameterized by a 
state i/j G and angles &a,&b G [0,7r], which spec- 
ify the ±l-valued observables Ai,A 2 and B 1} B 2 on Al- 
ice's and Bob's side. The concrete form of the observ- 
ables are given by Ai(9 A ) = J^j t (®A)ijX j and Bi(6 B ) = 
J2j with Xi = 01, X 2 = <t 3 and 



t(6) 







1 



sin o cos ( 



Because the observables are all real, an extremal P al- 
ways allows a representation with a real ip. To see this, 
we can write ip = 4> + ir/ with </>, 77 real vectors in Jtf. 
Note that if (iP,9a,0b) generates P so does (if), 0a, Ob), 
with if) the complex conjugate of if. Hence, the state 

p = UWW + IV s ) (V s !) = 5(1^)^1 + \v){v\) to s ether 

with 0a,0b generates the same P. But if P is extremal 
then also (4>,0a,0b) and (t],0a,0b) generates P, thus, 
the state can be chosen to be real. 

Moreover, the case sin# = corresponds to the case 
where the observables at Alice's or Bob's side commute, 
which corresponds to P which can be generated by a LHV 
model. Hence, we restrict our attention to representa- 
tions with a real if) and 7^ 0, tt. 

We want to construct T = £ 2 =i Pi(A k , B^P^A^B^ 
with 



P l = ^(oijAj ® 1 - fyl ® Bj 
3=1 



(Bl) 



where a and /3 are matrices in M 2 (C), such that the 
conditions 

(i) P l (A l (0 A ),B 3 (0 B ))if = for i = 1,2 

(ii) T — j = o c ijAi ® Bj for all possible observables 

Ai,BjinJ^ 

are satisfied. Note that a possible observable Aj has to 
satisfy A* = A. L and A 2 = 1. 

The restricted form of Pi limits the possible irre- 
ducible representation for which the method applies, 
which means that it is not always possible to find co- 
efficients a, f3 such that condition (i) and (ii) are satis- 
fied. The goal is to determine for which representations 



G 



this can be done and derive the corresponding Tsirelson 
inequality. 

We start by analyzing condition (i) . Using the particu- 
lar form of the observables Ai{6A) and Bj(0s) expressed 
through t(8), we find that Piip = 0, i = 1, 2, results in 



[Xi®l]ip = Y^ Vij I 1 ® X j]ip (* = 1, 2) 



(B2) 



where 77 = t(8 'a)^ 1 oT l j3t(9 b) ■ We assumed here that 
a is invertible. However, this is not a restriction since 
otherwise the state ip is of product form. 

In the following it is convenient to use the iso- 
morphism between and the Hilbert space M2(C) 
with the Hilbert- Schmidt inner product. States = 
(0i, 02, 03, 04) in Jl? are identified with matrices 



and [A<8> 1]0 (resp. [l<g£?]0) can be written as Acp (resp. 
(j)B T ). Moreover, we have that is a purific atio n of the 
density matrix p = ((f)* 
equivalent to 



on C . Equation (B2) is then 



(B3) 



The following assertio n ch aracterizes condition (i): ip 
admits an r\ such that (B2) is satisfied if and only if 
'i]j T ijj oc 1. Then, it holds that 



1 



Vij = 7:tr(-0 1 X i ipX j ). 



(B4) 



The proof goes as follows. First, we note that ip must 
be invertible. This is due to the fact that otherwise the 
reduced state of "0 given by (ip*ip) T has determinant 
and is therefore a pure state. We then multiply equation 
1 from the left to find ^ rjijX k X '.■ - 



j -TO""" J 

25k j, we can 



(B3l with X k ip 

X k ip~ 1 Xiip. Recalling that tr(X k Xj 
take the trace and obtain ( |B4| . 

We turn now to the first p art o f the statement. Mul- 
tiplication from the right of ( B3 1 with ip -1 shows that 
EjViji'Xj'ip- 1 



X 



Thus, we obtain that 



tr(XiX k ) = J~]T}ijTiiatT(XjXi), 
j,l 

from which follows that ip] T = 1. On the other hand 
one can check that the set G of all for which there 
exists a 77 such that ( B2 1 holds and det (ip) = 1, describes 



a group together with the usual matrix mul tiplication. 
Moreover, the map ip t— > rj(ip) induced by (B4) is a group 
homomorphism such that f](tp T ) — rj^ 1 . From this we 
can then conclude that ip T ip cx 1 is the necessary and 



sufficient condition to solve (B2) 



Because condition (i) is satisfied if and only if 



det 



is an orthogonal matrix, the possible states ip are param- 
eterized by 

1 



V2 



(cos x, =F sinx, sin 2, ± cosx) (B5) 



where x € [0, tt). The state -0 determines the correspond- 
ing 77 uniquely through equation (B4|. 



Since the reduced state of ip is equal to (tp*ip) , it 
follows directly that 0^ is maximally entangled. From 
this follows also that the expectation values of all local 
observables A[ and Bj vanish. 




FIG. 2: The plot shows the ratio r between the maximal 
quan tum and classical violation of the Tsirelson inequality 
(B6) corresponding to (ip — 0^T,#a = %,6b) for 6b £ (0, 7r) 
and x £ (0,7r/4). The domain is restricted due to condition 



(B7). The quotient r exhibits a 7r/4-periodic behavior in x 
and the peak of y/2 at x — -k/S and 9 b — tv/2 corresponds to 
a CHSH inequality. 



We turn now to condition (ii) and compute the expec- 
tation value of T with respect to G J$?, 

(2% =tr(a*a + p*tJ) 

- ^(a*(3 + (/3*a) T ) 3k (A 3 <g> B k )^ 

+ ^((«*a) jfc (A^ fc ) + (P*l3) jk (B 3 B k )^). 
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Thus, condition (ii) requires that the matrices a* a and 
ft* ft are diagonal. In this case the Tsirelson inequality 
reads 



3,k 



03*a) T )j fc <Aj ® B k ) < tr(a*a + 0*0). (B6) 



The coefficients Cjj in condition (ii) are therefore Cjfc = 
(a*p + {P*a) T ) ]k for j, k = 1, 2, c 00 = -tr(a*a + /?*/?), 
and the others 0. 

Since the expectation value of T is invariant under 
scaling and simultaneous unitary transformation of a 
and j3, we can without loss of generality assume that 
a = diag(l,A) with A > 0. This can always be 
achieved by the polar decomposition. Using now that 
i] = t(9 a)~ j a^ 1 f3t(9 b) we can write j3 = with 
7 = t{9 A)rjt{0 b)~ 1 ■ The condition that /3*/3 is diagonal 
is then equivalent to 



Condition ( B7 1 can then be computed to be 



±^2 



sin(2ir) sin(2x ± 9b) 
sin(2a; — 9 a) sin(2x — 9a ±0g] 



> 0. 



Provided that the inequality is satisfied, the method 
applies and we can compute a — diag(l, A) and j3 = 
from which the Tsirelson inequality (B6l can be deter- 
mined. Expressed in Ajjf, one finds that 



a*l3 + {f3* a y j 



± sin(2x±e B ) 



=p sin(2x) 



\ ±(\±) 2 sin(2x-6 A ±6 B ) T(^t) 2 sm(2x-6 A ) 



^2 = 711712 
721722 



>0, 



(B7) 



which completely characterizes condition (ii). 

Let us now summarize the results from the discus- 
sions of the two conditions. Condition (i) says that 
the only states ip for which the method applies are of 
the form (B5|. Hence, we can constrain to represen- 
with ip — (pi. For these states we 
can compute 77 via equation ( B4 1 , and insert it into 
1 to find that 



tations (iP,9a,9b) 

compute 7, 
7 = t(9 A )vt(9 B y 



± sin(2a; ± 9 B ) =Fsin(2a;) 
± sin(2x -6 A ±6 B ) T sin(2a; - 9 A ) 



and 



tr(a*a + /T/3) = - 



2 sin 9 A sin(4x — 9a i 9b) 
sin(2a; - 9 A ) sin(2a; -B A ± 9 B ) 



Among the possible P for which the method applies 
are the probability distributions which lead to maximal 
violation of a CHSH inequality. The corresponding rep- 
resentations are given by 9a = 9b = 7r/2 and ip = <fi^ 
with x = tt/8 + mr/4 (n = 0, 1, 2, 3). 
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